source3/nsswitch/winbindd_group.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind daemon for ntdom nss module
   5
   6    Copyright (C) Tim Potter 2000
   7    Copyright (C) Jeremy Allison 2001.
   8    Copyright (C) Gerald (Jerry) Carter 2003.
   9    Copyright (C) Volker Lendecke 2005
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 2 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program; if not, write to the Free Software
  23    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  24 */
  25
  26 #include "includes.h"
  27 #include "winbindd.h"
  28
  29 extern BOOL opt_nocache;
  30
  31 #undef DBGC_CLASS
  32 #define DBGC_CLASS DBGC_WINBIND
  33
  34 static void add_member(const char *domain, const char *user,
  35            char **pp_members, size_t *p_num_members)
  36 {
  37         fstring name;
  38
  39         fill_domain_username(name, domain, user, True);
  40         safe_strcat(name, ",", sizeof(name)-1);
  41         string_append(pp_members, name);
  42         *p_num_members += 1;
  43 }
  44
  45 /**********************************************************************
  46  Add member users resulting from sid. Expand if it is a domain group.
  47 **********************************************************************/
  48
  49 static void add_expanded_sid(const DOM_SID *sid, char **pp_members, size_t *p_num_members)
  50 {
  51         DOM_SID dom_sid;
  52         uint32 rid;
  53         struct winbindd_domain *domain;
  54         size_t i;
  55
  56         char *domain_name = NULL;
  57         char *name = NULL;
  58         enum lsa_SidType type;
  59
  60         uint32 num_names;
  61         DOM_SID *sid_mem;
  62         char **names;
  63         uint32 *types;
  64
  65         NTSTATUS result;
  66
  67         TALLOC_CTX *mem_ctx = talloc_init("add_expanded_sid");
  68
  69         if (mem_ctx == NULL) {
  70                 DEBUG(1, ("talloc_init failed\n"));
  71                 return;
  72         }
  73
  74         sid_copy(&dom_sid, sid);
  75         sid_split_rid(&dom_sid, &rid);
  76
  77         domain = find_lookup_domain_from_sid(sid);
  78
  79         if (domain == NULL) {
  80                 DEBUG(3, ("Could not find domain for sid %s\n",
  81                           sid_string_static(sid)));
  82                 goto done;
  83         }
  84
  85         result = domain->methods->sid_to_name(domain, mem_ctx, sid,
  86                                               &domain_name, &name, &type);
  87
  88         if (!NT_STATUS_IS_OK(result)) {
  89                 DEBUG(3, ("sid_to_name failed for sid %s\n",
  90                           sid_string_static(sid)));
  91                 goto done;
  92         }
  93
  94         DEBUG(10, ("Found name %s, type %d\n", name, type));
  95
  96         if (type == SID_NAME_USER) {
  97                 add_member(domain_name, name, pp_members, p_num_members);
  98                 goto done;
  99         }
 100
 101         if (type != SID_NAME_DOM_GRP) {
 102                 DEBUG(10, ("Alias member %s neither user nor group, ignore\n",
 103                            name));
 104                 goto done;
 105         }
 106
 107         /* Expand the domain group, this must be done via the target domain */
 108
 109         domain = find_domain_from_sid(sid);
 110
 111         if (domain == NULL) {
 112                 DEBUG(3, ("Could not find domain from SID %s\n",
 113                           sid_string_static(sid)));
 114                 goto done;
 115         }
 116
 117         result = domain->methods->lookup_groupmem(domain, mem_ctx,
 118                                                   sid, &num_names,
 119                                                   &sid_mem, &names,
 120                                                   &types);
 121
 122         if (!NT_STATUS_IS_OK(result)) {
 123                 DEBUG(10, ("Could not lookup group members for %s: %s\n",
 124                            name, nt_errstr(result)));
 125                 goto done;
 126         }
 127
 128         for (i=0; i<num_names; i++) {
 129                 DEBUG(10, ("Adding group member SID %s\n",
 130                            sid_string_static(&sid_mem[i])));
 131
 132                 if (types[i] != SID_NAME_USER) {
 133                         DEBUG(1, ("Hmmm. Member %s of group %s is no user. "
 134                                   "Ignoring.\n", names[i], name));
 135                         continue;
 136                 }
 137
 138                 add_member(domain->name, names[i], pp_members, p_num_members);
 139         }
 140
 141  done:
 142         talloc_destroy(mem_ctx);
 143         return;
 144 }
 145
 146 static BOOL fill_passdb_alias_grmem(struct winbindd_domain *domain,
 147                              DOM_SID *group_sid,
 148                              size_t *num_gr_mem, char **gr_mem, size_t *gr_mem_len)
 149 {
 150         DOM_SID *members;
 151         size_t i, num_members;
 152
 153         *num_gr_mem = 0;
 154         *gr_mem = NULL;
 155         *gr_mem_len = 0;
 156
 157         if (!NT_STATUS_IS_OK(pdb_enum_aliasmem(group_sid, &members,
 158                                                &num_members)))
 159                 return True;
 160
 161         for (i=0; i<num_members; i++) {
 162                 add_expanded_sid(&members[i], gr_mem, num_gr_mem);
 163         }
 164
 165         TALLOC_FREE(members);
 166
 167         if (*gr_mem != NULL) {
 168                 size_t len;
 169
 170                 /* We have at least one member, strip off the last "," */
 171                 len = strlen(*gr_mem);
 172                 (*gr_mem)[len-1] = '\0';
 173                 *gr_mem_len = len;
 174         }
 175
 176         return True;
 177 }
 178
 179 /* Fill a grent structure from various other information */
 180
 181 static BOOL fill_grent(struct winbindd_gr *gr, const char *dom_name,
 182                        const char *gr_name, gid_t unix_gid)
 183 {
 184         fstring full_group_name;
 185
 186         fill_domain_username( full_group_name, dom_name, gr_name, True );
 187
 188         gr->gr_gid = unix_gid;
 189
 190         /* Group name and password */
 191
 192         safe_strcpy(gr->gr_name, full_group_name, sizeof(gr->gr_name) - 1);
 193         safe_strcpy(gr->gr_passwd, "x", sizeof(gr->gr_passwd) - 1);
 194
 195         return True;
 196 }
 197
 198 /***********************************************************************
 199  If "enum users" is set to false, and the group being looked
 200  up is the Domain Users SID: S-1-5-domain-513, then for the
 201  list of members check if the querying user is in that group,
 202  and if so only return that user as the gr_mem array.
 203  We can change this to a different parameter than "enum users"
 204  if neccessaey, or parameterize the group list we do this for.
 205 ***********************************************************************/
 206
 207 static BOOL fill_grent_mem_domusers( TALLOC_CTX *mem_ctx,
 208                                      struct winbindd_domain *domain,
 209                                      struct winbindd_cli_state *state,
 210                                      DOM_SID *group_sid,
 211                                      enum lsa_SidType group_name_type,
 212                                      size_t *num_gr_mem, char **gr_mem,
 213                                      size_t *gr_mem_len)
 214 {
 215         DOM_SID querying_user_sid;
 216         DOM_SID *pquerying_user_sid = NULL;
 217         uint32 num_groups = 0;
 218         DOM_SID *user_sids = NULL;
 219         BOOL u_in_group = False;
 220         NTSTATUS status;
 221         int i;
 222         unsigned int buf_len = 0;
 223         char *buf = NULL;
 224
 225         DEBUG(10,("fill_grent_mem_domain_users: domain %s\n",
 226                   domain->name ));
 227
 228         if (state) {
 229                 uid_t ret_uid = (uid_t)-1;
 230                 if (sys_getpeereid(state->sock, &ret_uid)==0) {
 231                         /* We know who's asking - look up their SID if
 232                            it's one we've mapped before. */
 233                         status = idmap_uid_to_sid(&querying_user_sid, ret_uid);
 234                         if (NT_STATUS_IS_OK(status)) {
 235                                 pquerying_user_sid = &querying_user_sid;
 236                                 DEBUG(10,("fill_grent_mem_domain_users: querying uid %u -> %s\n",
 237                                           (unsigned int)ret_uid,
 238                                           sid_string_static(pquerying_user_sid) ));
 239                         }
 240                 }
 241         }
 242
 243         /* Only look up if it was a winbindd user in this domain. */
 244         if (pquerying_user_sid &&
 245             (sid_compare_domain(pquerying_user_sid, &domain->sid) == 0)) {
 246
 247                 DEBUG(10,("fill_grent_mem_domain_users: querying user = %s\n",
 248                           sid_string_static(pquerying_user_sid) ));
 249
 250                 status = domain->methods->lookup_usergroups(domain,
 251                                                             mem_ctx,
 252                                                             pquerying_user_sid,
 253                                                             &num_groups,
 254                                                             &user_sids);
 255                 if (!NT_STATUS_IS_OK(status)) {
 256                         DEBUG(1, ("fill_grent_mem_domain_users: lookup_usergroups failed "
 257                                   "for sid %s in domain %s (error: %s)\n",
 258                                   sid_string_static(pquerying_user_sid),
 259                                   domain->name,
 260                                   nt_errstr(status)));
 261                         return False;
 262                 }
 263
 264                 for (i = 0; i < num_groups; i++) {
 265                         if (sid_equal(group_sid, &user_sids[i])) {
 266                                 /* User is in Domain Users, add their name
 267                                    as the only group member. */
 268                                 u_in_group = True;
 269                                 break;
 270                         }
 271                 }
 272         }
 273
 274         if (u_in_group) {
 275                 size_t len = 0;
 276                 char *domainname = NULL;
 277                 char *username = NULL;
 278                 fstring name;
 279                 enum lsa_SidType type;
 280
 281                 DEBUG(10,("fill_grent_mem_domain_users: sid %s in 'Domain Users' in domain %s\n",
 282                           sid_string_static(pquerying_user_sid), domain->name ));
 283
 284                 status = domain->methods->sid_to_name(domain, mem_ctx,
 285                                                       pquerying_user_sid,
 286                                                       &domainname,
 287                                                       &username,
 288                                                       &type);
 289                 if (!NT_STATUS_IS_OK(status)) {
 290                         DEBUG(1, ("could not lookup username for user "
 291                                   "sid %s in domain %s (error: %s)\n",
 292                                   sid_string_static(pquerying_user_sid),
 293                                   domain->name,
 294                                   nt_errstr(status)));
 295                         return False;
 296                 }
 297                 fill_domain_username(name, domain->name, username, True);
 298                 len = strlen(name);
 299                 buf_len = len + 1;
 300                 if (!(buf = (char *)SMB_MALLOC(buf_len))) {
 301                         DEBUG(1, ("out of memory\n"));
 302                         return False;
 303                 }
 304                 memcpy(buf, name, buf_len);
 305
 306                 DEBUG(10,("fill_grent_mem_domain_users: user %s in "
 307                           "'Domain Users' in domain %s\n",
 308                           name, domain->name ));
 309
 310                 /* user is the only member */
 311                 *num_gr_mem = 1;
 312         }
 313
 314         *gr_mem = buf;
 315         *gr_mem_len = buf_len;
 316
 317         DEBUG(10, ("fill_grent_mem_domain_users: num_mem = %u, len = %u, mem = %s\n",
 318                    (unsigned int)*num_gr_mem,
 319                    (unsigned int)buf_len, *num_gr_mem ? buf : "NULL"));
 320
 321         return True;
 322 }
 323
 324 /***********************************************************************
 325  Add names to a list.  Assumes  a canonical version of the string
 326  in DOMAIN\user
 327 ***********************************************************************/
 328
 329 static int namecmp( const void *a, const void *b )
 330 {
 331         return StrCaseCmp( * (char * const *) a, * (char * const *) b);
 332 }
 333
 334 static NTSTATUS add_names_to_list( TALLOC_CTX *ctx,
 335                                    char ***list, uint32 *n_list,
 336                                    char **names, uint32 n_names )
 337 {
 338         char **new_list = NULL;
 339         uint32 n_new_list = 0;
 340         int i, j;
 341
 342         if ( !names || (n_names == 0) )
 343                 return NT_STATUS_OK;
 344
 345         /* Alloc the maximum size we'll need */
 346
 347         if ( *list == NULL ) {
 348                 if ( (new_list = TALLOC_ARRAY( ctx, char *, n_names )) == NULL )
 349                         return NT_STATUS_NO_MEMORY;
 350                 n_new_list = n_names;
 351         } else {
 352                 new_list = TALLOC_REALLOC_ARRAY( ctx, *list, char *,
 353                                                  (*n_list) + n_names );
 354                 if ( !new_list )
 355                         return NT_STATUS_NO_MEMORY;
 356                 n_new_list = (*n_list) + n_names;
 357         }
 358
 359         /* Add all names */
 360
 361         for ( i=*n_list, j=0; i<n_new_list; i++, j++ ) {
 362                 new_list[i] = talloc_strdup( new_list, names[j] );
 363         }
 364
 365         /* search for duplicates for sorting and looking for matching
 366            neighbors */
 367
 368         qsort( new_list, n_new_list, sizeof(char*), QSORT_CAST namecmp );
 369
 370         for ( i=1; i<n_new_list; i++ ) {
 371                 if ( strcmp( new_list[i-1], new_list[i] ) == 0 ) {
 372                         memmove( &new_list[i-1], &new_list[i],
 373                                  sizeof(char*)*(n_new_list-i) );
 374                         n_new_list--;
 375                 }
 376         }
 377
 378         *list = new_list;
 379         *n_list = n_new_list;
 380
 381         return NT_STATUS_OK;
 382 }
 383
 384 /***********************************************************************
 385 ***********************************************************************/
 386
 387 static NTSTATUS expand_groups( TALLOC_CTX *ctx,
 388                                struct winbindd_domain *d,
 389                                DOM_SID *glist, uint32 n_glist,
 390                                DOM_SID **new_glist, uint32 *n_new_glist,
 391                                char ***members, uint32 *n_members )
 392 {
 393         int i, j;
 394         NTSTATUS status = NT_STATUS_OK;
 395         uint32 num_names = 0;
 396         uint32 *name_types = NULL;
 397         char **names = NULL;
 398         DOM_SID *sid_mem = NULL;
 399         TALLOC_CTX *tmp_ctx = NULL;
 400         DOM_SID *new_groups = NULL;
 401         size_t new_groups_size = 0;
 402
 403         *members = NULL;
 404         *n_members = 0;
 405         *new_glist = NULL;
 406         *n_new_glist = 0;
 407
 408         for ( i=0; i<n_glist; i++ ) {
 409                 tmp_ctx = talloc_new( ctx );
 410
 411                 /* Lookup the group membership */
 412
 413                 status = d->methods->lookup_groupmem(d, tmp_ctx,
 414                                                      &glist[i], &num_names,
 415                                                      &sid_mem, &names,
 416                                                      &name_types);
 417                 if ( !NT_STATUS_IS_OK(status) )
 418                         goto out;
 419
 420                 /* Separate users and groups into two lists */
 421
 422                 for ( j=0; j<num_names; j++ ) {
 423
 424                         /* Users */
 425                         if ( name_types[j] == SID_NAME_USER ||
 426                              name_types[j] == SID_NAME_COMPUTER )
 427                         {
 428                                 status = add_names_to_list( ctx, members,
 429                                                             n_members,
 430                                                             names+j, 1 );
 431                                 if ( !NT_STATUS_IS_OK(status) )
 432                                         goto out;
 433
 434                                 continue;
 435                         }
 436
 437                         /* Groups */
 438                         if ( name_types[j] == SID_NAME_DOM_GRP ||
 439                              name_types[j] == SID_NAME_ALIAS )
 440                         {
 441                                 BOOL ret;
 442
 443                                 ret = add_sid_to_array_unique( ctx,
 444                                                                &sid_mem[j],
 445                                                                &new_groups,
 446                                                                &new_groups_size );
 447                                 if ( !ret ) {
 448                                         status = NT_STATUS_NO_MEMORY;
 449                                         goto out;
 450                                 }
 451
 452                                 continue;
 453                         }
 454                 }
 455
 456                 TALLOC_FREE( tmp_ctx );
 457         }
 458
 459         *new_glist = new_groups;
 460         *n_new_glist = (uint32)new_groups_size;
 461
 462  out:
 463         TALLOC_FREE( tmp_ctx );
 464
 465         return status;
 466 }
 467
 468 /***********************************************************************
 469  Fill in the group membership field of a NT group given by group_sid
 470 ***********************************************************************/
 471
 472 static BOOL fill_grent_mem(struct winbindd_domain *domain,
 473                            struct winbindd_cli_state *state,
 474                            DOM_SID *group_sid,
 475                            enum lsa_SidType group_name_type,
 476                            size_t *num_gr_mem, char **gr_mem, size_t *gr_mem_len)
 477 {
 478         uint32 num_names = 0;
 479         unsigned int buf_len = 0, buf_ndx = 0, i;
 480         char **names = NULL, *buf = NULL;
 481         BOOL result = False;
 482         TALLOC_CTX *mem_ctx;
 483         uint32 group_rid;
 484         DOM_SID *glist = NULL;
 485         DOM_SID *new_glist = NULL;
 486         uint32 n_glist, n_new_glist;
 487         int max_depth = lp_winbind_expand_groups();
 488
 489         if (!(mem_ctx = talloc_init("fill_grent_mem(%s)", domain->name)))
 490                 return False;
 491
 492         DEBUG(10, ("group SID %s\n", sid_string_static(group_sid)));
 493
 494         /* Initialize with no members */
 495
 496         *num_gr_mem = 0;
 497
 498         /* HACK ALERT!! This whole routine does not cope with group members
 499          * from more than one domain, ie aliases. Thus we have to work it out
 500          * ourselves in a special routine. */
 501
 502         if (domain->internal) {
 503                 result = fill_passdb_alias_grmem(domain, group_sid,
 504                                                num_gr_mem,
 505                                                gr_mem, gr_mem_len);
 506                 goto done;
 507         }
 508
 509         /* Verify name type */
 510
 511         if ( !((group_name_type==SID_NAME_DOM_GRP) ||
 512                ((group_name_type==SID_NAME_ALIAS) && domain->primary)) )
 513         {
 514                 DEBUG(1, ("SID %s in domain %s isn't a domain group (%d)\n",
 515                           sid_string_static(group_sid), domain->name,
 516                           group_name_type));
 517                 goto done;
 518         }
 519
 520         /* OPTIMIZATION / HACK. See comment in
 521            fill_grent_mem_domusers() */
 522
 523         sid_peek_rid( group_sid, &group_rid );
 524         if (!lp_winbind_enum_users() && group_rid == DOMAIN_GROUP_RID_USERS) {
 525                 result = fill_grent_mem_domusers( mem_ctx, domain, state,
 526                                                   group_sid, group_name_type,
 527                                                   num_gr_mem, gr_mem,
 528                                                   gr_mem_len );
 529                 goto done;
 530         }
 531
 532         /* Real work goes here.  Create a list of group names to
 533            expand startign with the initial one.  Pass that to
 534            expand_groups() which returns a list of more group names
 535            to expand.  Do this up to the max search depth. */
 536
 537         if ( (glist = TALLOC_ARRAY(mem_ctx, DOM_SID, 1 )) == NULL ) {
 538                 result = False;
 539                 DEBUG(0,("fill_grent_mem: talloc failure!\n"));
 540                 goto done;
 541         }
 542         sid_copy( &glist[0], group_sid );
 543         n_glist = 1;
 544
 545         for ( i=0; i<max_depth && glist; i++ ) {
 546                 uint32 n_members = 0;
 547                 char **members = NULL;
 548                 NTSTATUS nt_status;
 549
 550                 nt_status = expand_groups( mem_ctx, domain,
 551                                            glist, n_glist,
 552                                            &new_glist, &n_new_glist,
 553                                            &members, &n_members);
 554                 if ( !NT_STATUS_IS_OK(nt_status) ) {
 555                         result = False;
 556                         goto done;
 557                 }
 558
 559                 /* Add new group members to list */
 560
 561                 nt_status = add_names_to_list( mem_ctx, &names, &num_names,
 562                                                members, n_members );
 563                 if ( !NT_STATUS_IS_OK(nt_status) ) {
 564                         result = False;
 565                         goto done;
 566                 }
 567
 568                 TALLOC_FREE( members );
 569
 570                 /* If we have no more groups to expand, break out
 571                    early */
 572
 573                 if ( !&new_glist )
 574                         break;
 575
 576                 /* One more round */
 577                 TALLOC_FREE(glist);
 578                 glist = new_glist;
 579                 n_glist = n_new_glist;
 580         }
 581         TALLOC_FREE( glist );
 582
 583         DEBUG(10, ("looked up %d names\n", num_names));
 584
 585  again:
 586         /* Add members to list */
 587
 588         for (i = 0; i < num_names; i++) {
 589                 int len;
 590
 591                 DEBUG(10, ("processing name %s\n", names[i]));
 592
 593                 len = strlen(names[i]);
 594
 595                 /* Add to list or calculate buffer length */
 596
 597                 if (!buf) {
 598                         buf_len += len + 1; /* List is comma separated */
 599                         (*num_gr_mem)++;
 600                         DEBUG(10, ("buf_len + %d = %d\n", len + 1, buf_len));
 601                 } else {
 602                         DEBUG(10, ("appending %s at ndx %d\n", names[i], buf_ndx));
 603                         safe_strcpy(&buf[buf_ndx], names[i], len);
 604                         buf_ndx += len;
 605                         buf[buf_ndx] = ',';
 606                         buf_ndx++;
 607                 }
 608         }
 609
 610         /* Allocate buffer */
 611
 612         if (!buf && buf_len != 0) {
 613                 if (!(buf = (char *)SMB_MALLOC(buf_len))) {
 614                         DEBUG(1, ("out of memory\n"));
 615                         result = False;
 616                         goto done;
 617                 }
 618                 memset(buf, 0, buf_len);
 619                 goto again;
 620         }
 621
 622         /* Now we're done */
 623
 624         if (buf && buf_ndx > 0) {
 625                 buf[buf_ndx - 1] = '\0';
 626         }
 627
 628         *gr_mem = buf;
 629         *gr_mem_len = buf_len;
 630
 631         DEBUG(10, ("num_mem = %u, len = %u, mem = %s\n", (unsigned int)*num_gr_mem,
 632                    (unsigned int)buf_len, *num_gr_mem ? buf : "NULL"));
 633         result = True;
 634
 635 done:
 636
 637         talloc_destroy(mem_ctx);
 638
 639         DEBUG(10, ("fill_grent_mem returning %d\n", result));
 640
 641         return result;
 642 }
 643
 644 static void winbindd_getgrsid( struct winbindd_cli_state *state, DOM_SID group_sid );
 645
 646 static void getgrnam_recv( void *private_data, BOOL success, const DOM_SID *sid,
 647                            enum lsa_SidType type )
 648 {
 649         struct winbindd_cli_state *state = (struct winbindd_cli_state*)private_data;
 650
 651         if (!success) {
 652                 DEBUG(5,("getgrnam_recv: lookupname failed!\n"));
 653                 request_error(state);
 654                 return;
 655         }
 656
 657         if ( (type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) ) {
 658                 DEBUG(5,("getgrnam_recv: not a group!\n"));
 659                 request_error(state);
 660                 return;
 661         }
 662
 663         winbindd_getgrsid( state, *sid );
 664 }
 665
 666
 667 /* Return a group structure from a group name */
 668
 669 void winbindd_getgrnam(struct winbindd_cli_state *state)
 670 {
 671         struct winbindd_domain *domain;
 672         fstring name_domain, name_group;
 673         char *tmp;
 674
 675         /* Ensure null termination */
 676         state->request.data.groupname[sizeof(state->request.data.groupname)-1]='\0';
 677
 678         DEBUG(3, ("[%5lu]: getgrnam %s\n", (unsigned long)state->pid,
 679                   state->request.data.groupname));
 680
 681         /* Parse domain and groupname */
 682
 683         memset(name_group, 0, sizeof(fstring));
 684
 685         tmp = state->request.data.groupname;
 686
 687         name_domain[0] = '\0';
 688         name_group[0] = '\0';
 689
 690         parse_domain_user(tmp, name_domain, name_group);
 691
 692         /* if no domain or our local domain and no local tdb group, default to
 693          * our local domain for aliases */
 694
 695         if ( !*name_domain || strequal(name_domain, get_global_sam_name()) ) {
 696                 fstrcpy(name_domain, get_global_sam_name());
 697         }
 698
 699         /* Get info for the domain */
 700
 701         if ((domain = find_domain_from_name(name_domain)) == NULL) {
 702                 DEBUG(3, ("could not get domain sid for domain %s\n",
 703                           name_domain));
 704                 request_error(state);
 705                 return;
 706         }
 707         /* should we deal with users for our domain? */
 708
 709         if ( lp_winbind_trusted_domains_only() && domain->primary) {
 710                 DEBUG(7,("winbindd_getgrnam: My domain -- rejecting "
 711                          "getgrnam() for %s\\%s.\n", name_domain, name_group));
 712                 request_error(state);
 713                 return;
 714         }
 715
 716         /* Get rid and name type from name */
 717
 718         ws_name_replace( name_group, WB_REPLACE_CHAR );
 719
 720         winbindd_lookupname_async( state->mem_ctx, domain->name, name_group,
 721                                    getgrnam_recv, WINBINDD_GETGRNAM, state );
 722 }
 723
 724 struct getgrsid_state {
 725         struct winbindd_cli_state *state;
 726         struct winbindd_domain *domain;
 727         char *group_name;
 728         enum lsa_SidType group_type;
 729         uid_t gid;
 730         DOM_SID group_sid;
 731 };
 732
 733 static void getgrsid_sid2gid_recv(void *private_data, BOOL success, gid_t gid)
 734         {
 735         struct getgrsid_state *s =
 736                 (struct getgrsid_state *)private_data;
 737         struct winbindd_domain *domain;
 738         size_t gr_mem_len;
 739         size_t num_gr_mem;
 740         char *gr_mem;
 741         fstring dom_name, group_name;
 742
 743         if (!success) {
 744                 DEBUG(5,("getgrsid_sid2gid_recv: sid2gid failed!\n"));
 745                 request_error(s->state);
 746                 return;
 747         }
 748
 749         s->gid = gid;
 750
 751         if ( !parse_domain_user( s->group_name, dom_name, group_name ) ) {
 752                 DEBUG(5,("getgrsid_sid2gid_recv: parse_domain_user() failed!\n"));
 753                 request_error(s->state);
 754                 return;
 755         }
 756
 757
 758         /* Fill in group structure */
 759
 760         if ( (domain = find_domain_from_name_noinit(dom_name)) == NULL ) {
 761                 DEBUG(1,("Can't find domain from name (%s)\n", dom_name));
 762                 request_error(s->state);
 763                 return;
 764         }
 765
 766         if (!fill_grent(&s->state->response.data.gr, dom_name, group_name, gid) ||
 767             !fill_grent_mem(domain, s->state, &s->group_sid, s->group_type,
 768                             &num_gr_mem, &gr_mem, &gr_mem_len))
 769         {
 770                 request_error(s->state);
 771                 return;
 772         }
 773
 774         s->state->response.data.gr.num_gr_mem = (uint32)num_gr_mem;
 775
 776         /* Group membership lives at start of extra data */
 777
 778         s->state->response.data.gr.gr_mem_ofs = 0;
 779
 780         s->state->response.length += gr_mem_len;
 781         s->state->response.extra_data.data = gr_mem;
 782
 783         request_ok(s->state);
 784         }
 785
 786 static void getgrsid_lookupsid_recv( void *private_data, BOOL success,
 787                                      const char *dom_name, const char *name,
 788                                      enum lsa_SidType name_type )
 789 {
 790         struct getgrsid_state *s = (struct getgrsid_state *)private_data;
 791
 792         if (!success) {
 793                 DEBUG(5,("getgrsid_lookupsid_recv: lookupsid failed!\n"));
 794                 request_error(s->state);
 795                 return;
 796         }
 797
 798         /* either it's a domain group, a domain local group, or a
 799            local group in an internal domain */
 800
 801         if ( !( (name_type==SID_NAME_DOM_GRP) ||
 802                 ((name_type==SID_NAME_ALIAS) &&
 803                  (s->domain->primary || s->domain->internal)) ) )
 804         {
 805                 DEBUG(1, ("name '%s\\%s' is not a local or domain group: %d\n",
 806                           dom_name, name, name_type));
 807                 request_error(s->state);
 808                 return;
 809 }
 810
 811         if ( (s->group_name = talloc_asprintf( s->state->mem_ctx,
 812                                                "%s\\%s",
 813                                                dom_name, name )) == NULL )
 814 {
 815                 DEBUG(1, ("getgrsid_lookupsid_recv: talloc_asprintf() Failed!\n"));
 816                 request_error(s->state);
 817                 return;
 818         }
 819
 820         s->group_type = name_type;
 821
 822         winbindd_sid2gid_async(s->state->mem_ctx, &s->group_sid,
 823                                getgrsid_sid2gid_recv, s);
 824         }
 825
 826 static void winbindd_getgrsid( struct winbindd_cli_state *state, const DOM_SID group_sid )
 827         {
 828         struct getgrsid_state *s;
 829
 830         if ( (s = TALLOC_ZERO_P(state->mem_ctx, struct getgrsid_state)) == NULL ) {
 831                 DEBUG(0, ("talloc failed\n"));
 832                 request_error(state);
 833                 return;
 834         }
 835
 836         s->state = state;
 837
 838         if ( (s->domain = find_domain_from_sid_noinit(&group_sid)) == NULL ) {
 839                 DEBUG(3, ("Could not find domain for sid %s\n",
 840                           sid_string_static(&group_sid)));
 841                 request_error(state);
 842                 return;
 843         }
 844
 845         sid_copy(&s->group_sid, &group_sid);
 846
 847         winbindd_lookupsid_async( s->state->mem_ctx,  &group_sid,
 848                                   getgrsid_lookupsid_recv, s );
 849 }
 850
 851
 852 static void getgrgid_recv(void *private_data, BOOL success, const char *sid)
 853 {
 854         struct winbindd_cli_state *state = talloc_get_type_abort(private_data, struct winbindd_cli_state);
 855         enum lsa_SidType name_type;
 856         DOM_SID group_sid;
 857
 858         if (success) {
 859                 DEBUG(10,("getgrgid_recv: gid %lu has sid %s\n",
 860                           (unsigned long)(state->request.data.gid), sid));
 861
 862                 string_to_sid(&group_sid, sid);
 863                 winbindd_getgrsid(state, group_sid);
 864                 return;
 865         }
 866
 867         /* Ok, this might be "ours", i.e. an alias */
 868         if (pdb_gid_to_sid(state->request.data.gid, &group_sid) &&
 869             lookup_sid(state->mem_ctx, &group_sid, NULL, NULL, &name_type) &&
 870             (name_type == SID_NAME_ALIAS)) {
 871                 /* Hey, got an alias */
 872                 DEBUG(10,("getgrgid_recv: we have an alias with gid %lu and sid %s\n",
 873                           (unsigned long)(state->request.data.gid), sid));
 874                 winbindd_getgrsid(state, group_sid);
 875                 return;
 876         }
 877
 878         DEBUG(1, ("could not convert gid %lu to sid\n",
 879                   (unsigned long)state->request.data.gid));
 880         request_error(state);
 881 }
 882
 883 /* Return a group structure from a gid number */
 884 void winbindd_getgrgid(struct winbindd_cli_state *state)
 885 {
 886         DEBUG(3, ("[%5lu]: getgrgid %lu\n", (unsigned long)state->pid,
 887                   (unsigned long)state->request.data.gid));
 888
 889         /* always use the async interface */
 890         winbindd_gid2sid_async(state->mem_ctx, state->request.data.gid, getgrgid_recv, state);
 891 }
 892
 893 /*
 894  * set/get/endgrent functions
 895  */
 896
 897 /* "Rewind" file pointer for group database enumeration */
 898
 899 static BOOL winbindd_setgrent_internal(struct winbindd_cli_state *state)
 900 {
 901         struct winbindd_domain *domain;
 902
 903         DEBUG(3, ("[%5lu]: setgrent\n", (unsigned long)state->pid));
 904
 905         /* Check user has enabled this */
 906
 907         if (!lp_winbind_enum_groups()) {
 908                 return False;
 909         }
 910
 911         /* Free old static data if it exists */
 912
 913         if (state->getgrent_state != NULL) {
 914                 free_getent_state(state->getgrent_state);
 915                 state->getgrent_state = NULL;
 916         }
 917
 918         /* Create sam pipes for each domain we know about */
 919
 920         for (domain = domain_list(); domain != NULL; domain = domain->next) {
 921                 struct getent_state *domain_state;
 922
 923                 /* Create a state record for this domain */
 924
 925                 /* don't add our domaina if we are a PDC or if we
 926                    are a member of a Samba domain */
 927
 928                 if ( lp_winbind_trusted_domains_only() && domain->primary )
 929                 {
 930                         continue;
 931                 }
 932
 933
 934                 if ((domain_state = SMB_MALLOC_P(struct getent_state)) == NULL) {
 935                         DEBUG(1, ("winbindd_setgrent: malloc failed for domain_state!\n"));
 936                         return False;
 937                 }
 938
 939                 ZERO_STRUCTP(domain_state);
 940
 941                 fstrcpy(domain_state->domain_name, domain->name);
 942
 943                 /* Add to list of open domains */
 944
 945                 DLIST_ADD(state->getgrent_state, domain_state);
 946         }
 947
 948         state->getgrent_initialized = True;
 949         return True;
 950 }
 951
 952 void winbindd_setgrent(struct winbindd_cli_state *state)
 953 {
 954         if (winbindd_setgrent_internal(state)) {
 955                 request_ok(state);
 956         } else {
 957                 request_error(state);
 958         }
 959 }
 960
 961 /* Close file pointer to ntdom group database */
 962
 963 void winbindd_endgrent(struct winbindd_cli_state *state)
 964 {
 965         DEBUG(3, ("[%5lu]: endgrent\n", (unsigned long)state->pid));
 966
 967         free_getent_state(state->getgrent_state);
 968         state->getgrent_initialized = False;
 969         state->getgrent_state = NULL;
 970         request_ok(state);
 971 }
 972
 973 /* Get the list of domain groups and domain aliases for a domain.  We fill in
 974    the sam_entries and num_sam_entries fields with domain group information.
 975    The dispinfo_ndx field is incremented to the index of the next group to
 976    fetch. Return True if some groups were returned, False otherwise. */
 977
 978 static BOOL get_sam_group_entries(struct getent_state *ent)
 979 {
 980         NTSTATUS status;
 981         uint32 num_entries;
 982         struct acct_info *name_list = NULL;
 983         TALLOC_CTX *mem_ctx;
 984         BOOL result = False;
 985         struct acct_info *sam_grp_entries = NULL;
 986         struct winbindd_domain *domain;
 987
 988         if (ent->got_sam_entries)
 989                 return False;
 990
 991         if (!(mem_ctx = talloc_init("get_sam_group_entries(%s)",
 992                                           ent->domain_name))) {
 993                 DEBUG(1, ("get_sam_group_entries: could not create talloc context!\n"));
 994                 return False;
 995         }
 996
 997         /* Free any existing group info */
 998
 999         SAFE_FREE(ent->sam_entries);
1000         ent->num_sam_entries = 0;
1001         ent->got_sam_entries = True;
1002
1003         /* Enumerate domain groups */
1004
1005         num_entries = 0;
1006
1007         if (!(domain = find_domain_from_name(ent->domain_name))) {
1008                 DEBUG(3, ("no such domain %s in get_sam_group_entries\n", ent->domain_name));
1009                 goto done;
1010         }
1011
1012         /* always get the domain global groups */
1013
1014         status = domain->methods->enum_dom_groups(domain, mem_ctx, &num_entries, &sam_grp_entries);
1015
1016         if (!NT_STATUS_IS_OK(status)) {
1017                 DEBUG(3, ("get_sam_group_entries: could not enumerate domain groups! Error: %s\n", nt_errstr(status)));
1018                 result = False;
1019                 goto done;
1020         }
1021
1022         /* Copy entries into return buffer */
1023
1024         if (num_entries) {
1025                 if ( !(name_list = SMB_MALLOC_ARRAY(struct acct_info, num_entries)) ) {
1026                         DEBUG(0,("get_sam_group_entries: Failed to malloc memory for %d domain groups!\n",
1027                                 num_entries));
1028                         result = False;
1029                         goto done;
1030                 }
1031                 memcpy( name_list, sam_grp_entries, num_entries * sizeof(struct acct_info) );
1032         }
1033
1034         ent->num_sam_entries = num_entries;
1035
1036         /* get the domain local groups if we are a member of a native win2k domain
1037            and are not using LDAP to get the groups */
1038
1039         if ( ( lp_security() != SEC_ADS && domain->native_mode
1040                 && domain->primary) || domain->internal )
1041         {
1042                 DEBUG(4,("get_sam_group_entries: %s domain; enumerating local groups as well\n",
1043                         domain->native_mode ? "Native Mode 2k":"BUILTIN or local"));
1044
1045                 status = domain->methods->enum_local_groups(domain, mem_ctx, &num_entries, &sam_grp_entries);
1046
1047                 if ( !NT_STATUS_IS_OK(status) ) {
1048                         DEBUG(3,("get_sam_group_entries: Failed to enumerate domain local groups!\n"));
1049                         num_entries = 0;
1050                 }
1051                 else
1052                         DEBUG(4,("get_sam_group_entries: Returned %d local groups\n", num_entries));
1053
1054                 /* Copy entries into return buffer */
1055
1056                 if ( num_entries ) {
1057                         if ( !(name_list = SMB_REALLOC_ARRAY( name_list, struct acct_info, ent->num_sam_entries+num_entries)) )
1058                         {
1059                                 DEBUG(0,("get_sam_group_entries: Failed to realloc more memory for %d local groups!\n",
1060                                         num_entries));
1061                                 result = False;
1062                                 goto done;
1063                         }
1064
1065                         memcpy( &name_list[ent->num_sam_entries], sam_grp_entries,
1066                                 num_entries * sizeof(struct acct_info) );
1067                 }
1068
1069                 ent->num_sam_entries += num_entries;
1070         }
1071
1072
1073         /* Fill in remaining fields */
1074
1075         ent->sam_entries = name_list;
1076         ent->sam_entry_index = 0;
1077
1078         result = (ent->num_sam_entries > 0);
1079
1080  done:
1081         talloc_destroy(mem_ctx);
1082
1083         return result;
1084 }
1085
1086 /* Fetch next group entry from ntdom database */
1087
1088 #define MAX_GETGRENT_GROUPS 500
1089
1090 void winbindd_getgrent(struct winbindd_cli_state *state)
1091 {
1092         struct getent_state *ent;
1093         struct winbindd_gr *group_list = NULL;
1094         int num_groups, group_list_ndx, gr_mem_list_len = 0;
1095         char *gr_mem_list = NULL;
1096
1097         DEBUG(3, ("[%5lu]: getgrent\n", (unsigned long)state->pid));
1098
1099         /* Check user has enabled this */
1100
1101         if (!lp_winbind_enum_groups()) {
1102                 request_error(state);
1103                 return;
1104         }
1105
1106         num_groups = MIN(MAX_GETGRENT_GROUPS, state->request.data.num_entries);
1107
1108         if (num_groups == 0) {
1109                 request_error(state);
1110                 return;
1111         }
1112
1113         if ((state->response.extra_data.data = SMB_MALLOC_ARRAY(struct winbindd_gr, num_groups)) == NULL) {
1114                 request_error(state);
1115                 return;
1116         }
1117
1118         memset(state->response.extra_data.data, '\0',
1119                 num_groups * sizeof(struct winbindd_gr) );
1120
1121         state->response.data.num_entries = 0;
1122
1123         group_list = (struct winbindd_gr *)state->response.extra_data.data;
1124
1125         if (!state->getgrent_initialized)
1126                 winbindd_setgrent_internal(state);
1127
1128         if (!(ent = state->getgrent_state)) {
1129                 request_error(state);
1130                 return;
1131         }
1132
1133         /* Start sending back groups */
1134
1135         for (group_list_ndx = 0; group_list_ndx < num_groups; ) {
1136                 struct acct_info *name_list = NULL;
1137                 fstring domain_group_name;
1138                 uint32 result;
1139                 gid_t group_gid;
1140                 size_t gr_mem_len;
1141                 char *gr_mem;
1142                 DOM_SID group_sid;
1143                 struct winbindd_domain *domain;
1144
1145                 /* Do we need to fetch another chunk of groups? */
1146
1147         tryagain:
1148
1149                 DEBUG(10, ("entry_index = %d, num_entries = %d\n",
1150                            ent->sam_entry_index, ent->num_sam_entries));
1151
1152                 if (ent->num_sam_entries == ent->sam_entry_index) {
1153
1154                         while(ent && !get_sam_group_entries(ent)) {
1155                                 struct getent_state *next_ent;
1156
1157                                 DEBUG(10, ("freeing state info for domain %s\n", ent->domain_name));
1158
1159                                 /* Free state information for this domain */
1160
1161                                 SAFE_FREE(ent->sam_entries);
1162
1163                                 next_ent = ent->next;
1164                                 DLIST_REMOVE(state->getgrent_state, ent);
1165
1166                                 SAFE_FREE(ent);
1167                                 ent = next_ent;
1168                         }
1169
1170                         /* No more domains */
1171
1172                         if (!ent)
1173                                 break;
1174                 }
1175
1176                 name_list = (struct acct_info *)ent->sam_entries;
1177
1178                 if (!(domain =
1179                       find_domain_from_name(ent->domain_name))) {
1180                         DEBUG(3, ("No such domain %s in winbindd_getgrent\n", ent->domain_name));
1181                         result = False;
1182                         goto done;
1183                 }
1184
1185                 /* Lookup group info */
1186
1187                 sid_copy(&group_sid, &domain->sid);
1188                 sid_append_rid(&group_sid, name_list[ent->sam_entry_index].rid);
1189
1190                 if (!NT_STATUS_IS_OK(idmap_sid_to_gid(&group_sid, &group_gid))) {
1191                         union unid_t id;
1192                         enum lsa_SidType type;
1193
1194                         DEBUG(10, ("SID %s not in idmap\n",
1195                                    sid_string_static(&group_sid)));
1196
1197                         if (!pdb_sid_to_id(&group_sid, &id, &type)) {
1198                                 DEBUG(1, ("could not look up gid for group "
1199                                           "%s\n",
1200                                           name_list[ent->sam_entry_index].acct_name));
1201                                 ent->sam_entry_index++;
1202                                 goto tryagain;
1203                         }
1204
1205                         if ((type != SID_NAME_DOM_GRP) &&
1206                             (type != SID_NAME_ALIAS) &&
1207                             (type != SID_NAME_WKN_GRP)) {
1208                                 DEBUG(1, ("Group %s is a %s, not a group\n",
1209                                           sid_type_lookup(type),
1210                                           name_list[ent->sam_entry_index].acct_name));
1211                                 ent->sam_entry_index++;
1212                                 goto tryagain;
1213                         }
1214                         group_gid = id.gid;
1215                 }
1216
1217                 DEBUG(10, ("got gid %lu for group %lu\n", (unsigned long)group_gid,
1218                            (unsigned long)name_list[ent->sam_entry_index].rid));
1219
1220                 /* Fill in group entry */
1221
1222                 fill_domain_username(domain_group_name, ent->domain_name,
1223                          name_list[ent->sam_entry_index].acct_name, True);
1224
1225                 result = fill_grent(&group_list[group_list_ndx],
1226                                     ent->domain_name,
1227                                     name_list[ent->sam_entry_index].acct_name,
1228                                     group_gid);
1229
1230                 /* Fill in group membership entry */
1231
1232                 if (result) {
1233                         size_t num_gr_mem = 0;
1234                         DOM_SID member_sid;
1235                         group_list[group_list_ndx].num_gr_mem = 0;
1236                         gr_mem = NULL;
1237                         gr_mem_len = 0;
1238
1239                         /* Get group membership */
1240                         if (state->request.cmd == WINBINDD_GETGRLST) {
1241                                 result = True;
1242                         } else {
1243                                 sid_copy(&member_sid, &domain->sid);
1244                                 sid_append_rid(&member_sid, name_list[ent->sam_entry_index].rid);
1245                                 result = fill_grent_mem(
1246                                         domain,
1247                                         NULL,
1248                                         &member_sid,
1249                                         SID_NAME_DOM_GRP,
1250                                         &num_gr_mem,
1251                                         &gr_mem, &gr_mem_len);
1252
1253                                 group_list[group_list_ndx].num_gr_mem = (uint32)num_gr_mem;
1254                         }
1255                 }
1256
1257                 if (result) {
1258                         /* Append to group membership list */
1259                         gr_mem_list = (char *)SMB_REALLOC(
1260                                 gr_mem_list, gr_mem_list_len + gr_mem_len);
1261
1262                         if (!gr_mem_list && (group_list[group_list_ndx].num_gr_mem != 0)) {
1263                                 DEBUG(0, ("out of memory\n"));
1264                                 gr_mem_list_len = 0;
1265                                 break;
1266                         }
1267
1268                         DEBUG(10, ("list_len = %d, mem_len = %u\n",
1269                                    gr_mem_list_len, (unsigned int)gr_mem_len));
1270
1271                         memcpy(&gr_mem_list[gr_mem_list_len], gr_mem,
1272                                gr_mem_len);
1273
1274                         SAFE_FREE(gr_mem);
1275
1276                         group_list[group_list_ndx].gr_mem_ofs =
1277                                 gr_mem_list_len;
1278
1279                         gr_mem_list_len += gr_mem_len;
1280                 }
1281
1282                 ent->sam_entry_index++;
1283
1284                 /* Add group to return list */
1285
1286                 if (result) {
1287
1288                         DEBUG(10, ("adding group num_entries = %d\n",
1289                                    state->response.data.num_entries));
1290
1291                         group_list_ndx++;
1292                         state->response.data.num_entries++;
1293
1294                         state->response.length +=
1295                                 sizeof(struct winbindd_gr);
1296
1297                 } else {
1298                         DEBUG(0, ("could not lookup domain group %s\n",
1299                                   domain_group_name));
1300                 }
1301         }
1302
1303         /* Copy the list of group memberships to the end of the extra data */
1304
1305         if (group_list_ndx == 0)
1306                 goto done;
1307
1308         state->response.extra_data.data = SMB_REALLOC(
1309                 state->response.extra_data.data,
1310                 group_list_ndx * sizeof(struct winbindd_gr) + gr_mem_list_len);
1311
1312         if (!state->response.extra_data.data) {
1313                 DEBUG(0, ("out of memory\n"));
1314                 group_list_ndx = 0;
1315                 SAFE_FREE(gr_mem_list);
1316                 request_error(state);
1317                 return;
1318         }
1319
1320         memcpy(&((char *)state->response.extra_data.data)
1321                [group_list_ndx * sizeof(struct winbindd_gr)],
1322                gr_mem_list, gr_mem_list_len);
1323
1324         state->response.length += gr_mem_list_len;
1325
1326         DEBUG(10, ("returning %d groups, length = %d\n",
1327                    group_list_ndx, gr_mem_list_len));
1328
1329         /* Out of domains */
1330
1331  done:
1332
1333         SAFE_FREE(gr_mem_list);
1334
1335         if (group_list_ndx > 0)
1336                 request_ok(state);
1337         else
1338                 request_error(state);
1339 }
1340
1341 /* List domain groups without mapping to unix ids */
1342
1343 void winbindd_list_groups(struct winbindd_cli_state *state)
1344 {
1345         uint32 total_entries = 0;
1346         struct winbindd_domain *domain;
1347         const char *which_domain;
1348         char *extra_data = NULL;
1349         unsigned int extra_data_len = 0, i;
1350
1351         DEBUG(3, ("[%5lu]: list groups\n", (unsigned long)state->pid));
1352
1353         /* Ensure null termination */
1354         state->request.domain_name[sizeof(state->request.domain_name)-1]='\0';
1355         which_domain = state->request.domain_name;
1356
1357         /* Enumerate over trusted domains */
1358
1359         for (domain = domain_list(); domain; domain = domain->next) {
1360                 struct getent_state groups;
1361
1362                 /* if we have a domain name restricting the request and this
1363                    one in the list doesn't match, then just bypass the remainder
1364                    of the loop */
1365
1366                 if ( *which_domain && !strequal(which_domain, domain->name) )
1367                         continue;
1368
1369                 ZERO_STRUCT(groups);
1370
1371                 /* Get list of sam groups */
1372
1373                 fstrcpy(groups.domain_name, domain->name);
1374
1375                 get_sam_group_entries(&groups);
1376
1377                 if (groups.num_sam_entries == 0) {
1378                         /* this domain is empty or in an error state */
1379                         continue;
1380                 }
1381
1382                 /* keep track the of the total number of groups seen so
1383                    far over all domains */
1384                 total_entries += groups.num_sam_entries;
1385
1386                 /* Allocate some memory for extra data.  Note that we limit
1387                    account names to sizeof(fstring) = 128 characters.  */
1388                 extra_data = (char *)SMB_REALLOC(
1389                         extra_data, sizeof(fstring) * total_entries);
1390
1391                 if (!extra_data) {
1392                         DEBUG(0,("failed to enlarge buffer!\n"));
1393                         request_error(state);
1394                         return;
1395                 }
1396
1397                 /* Pack group list into extra data fields */
1398                 for (i = 0; i < groups.num_sam_entries; i++) {
1399                         char *group_name = ((struct acct_info *)
1400                                             groups.sam_entries)[i].acct_name;
1401                         fstring name;
1402
1403                         fill_domain_username(name, domain->name, group_name, True);
1404                         /* Append to extra data */
1405                         memcpy(&extra_data[extra_data_len], name,
1406                                strlen(name));
1407                         extra_data_len += strlen(name);
1408                         extra_data[extra_data_len++] = ',';
1409                 }
1410
1411                 SAFE_FREE(groups.sam_entries);
1412         }
1413
1414         /* Assign extra_data fields in response structure */
1415         if (extra_data) {
1416                 extra_data[extra_data_len - 1] = '\0';
1417                 state->response.extra_data.data = extra_data;
1418                 state->response.length += extra_data_len;
1419         }
1420
1421         /* No domains may have responded but that's still OK so don't
1422            return an error. */
1423
1424         request_ok(state);
1425 }
1426
1427 /* Get user supplementary groups.  This is much quicker than trying to
1428    invert the groups database.  We merge the groups from the gids and
1429    other_sids info3 fields as trusted domain, universal group
1430    memberships, and nested groups (win2k native mode only) are not
1431    returned by the getgroups RPC call but are present in the info3. */
1432
1433 struct getgroups_state {
1434         struct winbindd_cli_state *state;
1435         struct winbindd_domain *domain;
1436         char *domname;
1437         char *username;
1438         DOM_SID user_sid;
1439
1440         const DOM_SID *token_sids;
1441         size_t i, num_token_sids;
1442
1443         gid_t *token_gids;
1444         size_t num_token_gids;
1445 };
1446
1447 static void getgroups_usersid_recv(void *private_data, BOOL success,
1448                                    const DOM_SID *sid, enum lsa_SidType type);
1449 static void getgroups_tokensids_recv(void *private_data, BOOL success,
1450                                      DOM_SID *token_sids, size_t num_token_sids);
1451 static void getgroups_sid2gid_recv(void *private_data, BOOL success, gid_t gid);
1452
1453 void winbindd_getgroups(struct winbindd_cli_state *state)
1454 {
1455         struct getgroups_state *s;
1456
1457         /* Ensure null termination */
1458         state->request.data.username
1459                 [sizeof(state->request.data.username)-1]='\0';
1460
1461         DEBUG(3, ("[%5lu]: getgroups %s\n", (unsigned long)state->pid,
1462                   state->request.data.username));
1463
1464         /* Parse domain and username */
1465
1466         s = TALLOC_P(state->mem_ctx, struct getgroups_state);
1467         if (s == NULL) {
1468                 DEBUG(0, ("talloc failed\n"));
1469                 request_error(state);
1470                 return;
1471         }
1472
1473         s->state = state;
1474
1475         ws_name_return( state->request.data.username, WB_REPLACE_CHAR );
1476
1477         if (!parse_domain_user_talloc(state->mem_ctx,
1478                                       state->request.data.username,
1479                                       &s->domname, &s->username)) {
1480                 DEBUG(5, ("Could not parse domain user: %s\n",
1481                           state->request.data.username));
1482
1483                 /* error out if we do not have nested group support */
1484
1485                 if ( !lp_winbind_nested_groups() ) {
1486                         request_error(state);
1487                         return;
1488                 }
1489
1490                 s->domname = talloc_strdup( state->mem_ctx, get_global_sam_name() );
1491                 s->username = talloc_strdup( state->mem_ctx, state->request.data.username );
1492         }
1493
1494         /* Get info for the domain */
1495
1496         s->domain = find_domain_from_name_noinit(s->domname);
1497
1498         if (s->domain == NULL) {
1499                 DEBUG(7, ("could not find domain entry for domain %s\n",
1500                           s->domname));
1501                 request_error(state);
1502                 return;
1503         }
1504
1505         if ( s->domain->primary && lp_winbind_trusted_domains_only()) {
1506                 DEBUG(7,("winbindd_getgroups: My domain -- rejecting "
1507                          "getgroups() for %s\\%s.\n", s->domname,
1508                          s->username));
1509                 request_error(state);
1510                 return;
1511         }
1512
1513         /* Get rid and name type from name.  The following costs 1 packet */
1514
1515         winbindd_lookupname_async(state->mem_ctx, s->domname, s->username,
1516                                   getgroups_usersid_recv, WINBINDD_GETGROUPS, s);
1517 }
1518
1519 static void getgroups_usersid_recv(void *private_data, BOOL success,
1520                                    const DOM_SID *sid, enum lsa_SidType type)
1521 {
1522         struct getgroups_state *s =
1523                 (struct getgroups_state *)private_data;
1524
1525         if ((!success) ||
1526             ((type != SID_NAME_USER) && (type != SID_NAME_COMPUTER))) {
1527                 request_error(s->state);
1528                 return;
1529         }
1530
1531         sid_copy(&s->user_sid, sid);
1532
1533         winbindd_gettoken_async(s->state->mem_ctx, &s->user_sid,
1534                                 getgroups_tokensids_recv, s);
1535 }
1536
1537 static void getgroups_tokensids_recv(void *private_data, BOOL success,
1538                                      DOM_SID *token_sids, size_t num_token_sids)
1539 {
1540         struct getgroups_state *s =
1541                 (struct getgroups_state *)private_data;
1542
1543         /* We need at least the user sid and the primary group in the token,
1544          * otherwise it's an error */
1545
1546         if ((!success) || (num_token_sids < 2)) {
1547                 request_error(s->state);
1548                 return;
1549         }
1550
1551         s->token_sids = token_sids;
1552         s->num_token_sids = num_token_sids;
1553         s->i = 0;
1554
1555         s->token_gids = NULL;
1556         s->num_token_gids = 0;
1557
1558         getgroups_sid2gid_recv(s, False, 0);
1559 }
1560
1561 static void getgroups_sid2gid_recv(void *private_data, BOOL success, gid_t gid)
1562 {
1563         struct getgroups_state *s =
1564                 (struct getgroups_state *)private_data;
1565
1566         if (success) {
1567                 if (!add_gid_to_array_unique(s->state->mem_ctx, gid,
1568                                         &s->token_gids,
1569                                         &s->num_token_gids)) {
1570                         return;
1571                 }
1572         }
1573
1574         if (s->i < s->num_token_sids) {
1575                 const DOM_SID *sid = &s->token_sids[s->i];
1576                 s->i += 1;
1577
1578                 if (sid_equal(sid, &s->user_sid)) {
1579                         getgroups_sid2gid_recv(s, False, 0);
1580                         return;
1581                 }
1582
1583                 winbindd_sid2gid_async(s->state->mem_ctx, sid,
1584                                        getgroups_sid2gid_recv, s);
1585                 return;
1586         }
1587
1588         s->state->response.data.num_entries = s->num_token_gids;
1589         /* s->token_gids are talloced */
1590         s->state->response.extra_data.data = smb_xmemdup(s->token_gids, s->num_token_gids * sizeof(gid_t));
1591         s->state->response.length += s->num_token_gids * sizeof(gid_t);
1592         request_ok(s->state);
1593 }
1594
1595 /* Get user supplementary sids. This is equivalent to the
1596    winbindd_getgroups() function but it involves a SID->SIDs mapping
1597    rather than a NAME->SID->SIDS->GIDS mapping, which means we avoid
1598    idmap. This call is designed to be used with applications that need
1599    to do ACL evaluation themselves. Note that the cached info3 data is
1600    not used
1601
1602    this function assumes that the SID that comes in is a user SID. If
1603    you pass in another type of SID then you may get unpredictable
1604    results.
1605 */
1606
1607 static void getusersids_recv(void *private_data, BOOL success, DOM_SID *sids,
1608                              size_t num_sids);
1609
1610 void winbindd_getusersids(struct winbindd_cli_state *state)
1611 {
1612         DOM_SID *user_sid;
1613
1614         /* Ensure null termination */
1615         state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
1616
1617         user_sid = TALLOC_P(state->mem_ctx, DOM_SID);
1618         if (user_sid == NULL) {
1619                 DEBUG(1, ("talloc failed\n"));
1620                 request_error(state);
1621                 return;
1622         }
1623
1624         if (!string_to_sid(user_sid, state->request.data.sid)) {
1625                 DEBUG(1, ("Could not get convert sid %s from string\n",
1626                           state->request.data.sid));
1627                 request_error(state);
1628                 return;
1629         }
1630
1631         winbindd_gettoken_async(state->mem_ctx, user_sid, getusersids_recv,
1632                                 state);
1633 }
1634
1635 static void getusersids_recv(void *private_data, BOOL success, DOM_SID *sids,
1636                              size_t num_sids)
1637 {
1638         struct winbindd_cli_state *state =
1639                 (struct winbindd_cli_state *)private_data;
1640         char *ret = NULL;
1641         unsigned ofs, ret_size = 0;
1642         size_t i;
1643
1644         if (!success) {
1645                 request_error(state);
1646                 return;
1647         }
1648
1649         /* work out the response size */
1650         for (i = 0; i < num_sids; i++) {
1651                 const char *s = sid_string_static(&sids[i]);
1652                 ret_size += strlen(s) + 1;
1653         }
1654
1655         /* build the reply */
1656         ret = (char *)SMB_MALLOC(ret_size);
1657         if (!ret) {
1658                 DEBUG(0, ("malloc failed\n"));
1659                 request_error(state);
1660                 return;
1661         }
1662         ofs = 0;
1663         for (i = 0; i < num_sids; i++) {
1664                 const char *s = sid_string_static(&sids[i]);
1665                 safe_strcpy(ret + ofs, s, ret_size - ofs - 1);
1666                 ofs += strlen(ret+ofs) + 1;
1667         }
1668
1669         /* Send data back to client */
1670         state->response.data.num_entries = num_sids;
1671         state->response.extra_data.data = ret;
1672         state->response.length += ret_size;
1673         request_ok(state);
1674 }
1675
1676 void winbindd_getuserdomgroups(struct winbindd_cli_state *state)
1677 {
1678         DOM_SID user_sid;
1679         struct winbindd_domain *domain;
1680
1681         /* Ensure null termination */
1682         state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
1683
1684         if (!string_to_sid(&user_sid, state->request.data.sid)) {
1685                 DEBUG(1, ("Could not get convert sid %s from string\n",
1686                           state->request.data.sid));
1687                 request_error(state);
1688                 return;
1689         }
1690
1691         /* Get info for the domain */
1692         if ((domain = find_domain_from_sid_noinit(&user_sid)) == NULL) {
1693                 DEBUG(0,("could not find domain entry for sid %s\n",
1694                          sid_string_static(&user_sid)));
1695                 request_error(state);
1696                 return;
1697         }
1698
1699         sendto_domain(state, domain);
1700 }
1701
1702 enum winbindd_result winbindd_dual_getuserdomgroups(struct winbindd_domain *domain,
1703                                                     struct winbindd_cli_state *state)
1704 {
1705         DOM_SID user_sid;
1706         NTSTATUS status;
1707
1708         char *sidstring;
1709         ssize_t len;
1710         DOM_SID *groups;
1711         uint32 num_groups;
1712
1713         /* Ensure null termination */
1714         state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
1715
1716         if (!string_to_sid(&user_sid, state->request.data.sid)) {
1717                 DEBUG(1, ("Could not get convert sid %s from string\n",
1718                           state->request.data.sid));
1719                 return WINBINDD_ERROR;
1720         }
1721
1722         status = domain->methods->lookup_usergroups(domain, state->mem_ctx,
1723                                                     &user_sid, &num_groups,
1724                                                     &groups);
1725         if (!NT_STATUS_IS_OK(status))
1726                 return WINBINDD_ERROR;
1727
1728         if (num_groups == 0) {
1729                 state->response.data.num_entries = 0;
1730                 state->response.extra_data.data = NULL;
1731                 return WINBINDD_OK;
1732         }
1733
1734         if (!print_sidlist(state->mem_ctx, groups, num_groups, &sidstring, &len)) {
1735                 DEBUG(0, ("talloc failed\n"));
1736                 return WINBINDD_ERROR;
1737         }
1738
1739         state->response.extra_data.data = SMB_STRDUP(sidstring);
1740         if (!state->response.extra_data.data) {
1741                 return WINBINDD_ERROR;
1742         }
1743         state->response.length += len+1;
1744         state->response.data.num_entries = num_groups;
1745
1746         return WINBINDD_OK;
1747 }